The internet is having a very bad cybersecurity day

TechCrunch, citing Reuters, reports that government websites around the world went offline after AI discovered critical security vulnerabilities that impacted the programming language PHP.[1]According to TechCrunch, the U.S. National Security Agency (NSA) advised organizations using PHP on their systems to either immediately update or take their systems offline until they could.[2] The outlet says PHP "powers roughly 70% of the websites on the internet"[3] and that these holes have been tucked away in all versions of PHP since version 5, which was released in 2004.[3]Techmeme's roundup cites OpenAI as saying the flaws, found using GPT-5.6 Sol, "are among several significant vulnerabilities"[4] it found.TechCrunch also reports that Node.js shared that four high-severity vulnerabilities were just patched in its latest release[2]. According to the outlet, one allowed remote code execution, and two others would have permitted a TLS validation bypass[2].According to daily.dev's summary of the TechCrunch piece, LiteLLM was compromised with malicious packages pushed to PyPI, Docker Hub, and GHCR containing an infostealer and remote access trojan.[5]TechCrunch reports that Indian certificate authority eMudhra had its private keys compromised, potentially allowing attackers to issue fraudulent certificates[3]. The outlet says security professionals have called the cleanup "bigger than Heartbleed."[3]TechCrunch says that though the issues were unrelated to each other, their back-to-back arrival highlights the challenges cybersecurity teams now face.[1]